org: Pfcloud UG

country: NL

greynoise: malicious

transport: tcp

software: OpenSSH 9.2p1

notes: GreyNoise classified as malicious. RDP crawler and bruteforcer. OpenSSH 9.2p1 on port 22.


org: Prospero Ooo

country: TM

greynoise: unknown

notes: No services visible on Censys. Scan-only behavior in Honeylabs with 3890 events hitting diverse high ports.


org: Private Layer INC

country: CH

software: OpenSSH 8.9p1

notes: 1518 events in Honeylabs targeting diverse ports. SSH service exposed.


org: RouterHosting LLC

country: US

greynoise: suspicious

software: nginx

hostname: cloudzy

notes: GreyNoise suspicious. Multi-vuln scanner: Wordpress, CrushFTP, Ivanti, OWA. 94 events in Honeylabs.


notes: 992 events in Honeylabs targeting diverse high ports. Output truncated and saved to tool-output cache.


org: Proton66 OOO

country: RU

notes: GreyNoise malicious. Multi-protocol bruteforcer (RDP, SSH, Telnet, FTP). 429 events in Honeylabs.


org: FlokiNET ehf

country: RO

hostname: PremiumTorExit

notes: Confirmed Tor exit node. Software: Tor 0.4.9.11. Port 9001. 17 events in Honeylabs scanning HTTP/SSH.


org: Kprohost LLC

country: UA

hostname: lanedonet-datacenter

location: Kerkrade, NL

notes: 26 events in Honeylabs. Hosted in Lanedonet Datacenter, Kerkrade NL. HTTPS scanning.


org: Datashield Inc.

country: SC

hostname: short-tan-rat

location: Seychelles

notes: 4 events in Honeylabs. Hostname 'short-tan-rat'. Exchange /ews/ recon via TLS. Registered in Seychelles.


org: ZhouyiSat Communications

tls_cert_issuer: WIN-8FIH4EGN4AL (self-signed)

notes: 2 events in Honeylabs. Self-signed cert on hostname usa.unlimitedteam.space. .env file scanning activity.